Also called "re-encryption," SSL/TLS bridging involves decrypting incoming HTTPS traffic and then re-encrypting it before forwarding to the server. Bridging lets users establish a secure connection with the load balancer via a frontend certificate. The load balancer's backend then forms a newly secured connection before re-encrypting those requests via the backend certificate.
How does SSL/TLS bridging work?
First, the load balancer receives requests over an SSL connection that was previously established using a symmetric cipher and shared keys. The client and load balancer exchange these components once the secure connection is created. It's also only known to those two parties, which maintains secrecy.
Next, the certificate employs one of many cryptographic methods to protect forwarded requests from man-in-the-middle (MITM) attacks as they approach backend servers. This is often based on a vital combination of user IDs and public keys, which are codependent and form a trusting relationship between authorized parties.
You’ve mastered one topic, but why stop there?
Our blog delivers the expert insights, industry analysis, and helpful tips you need to build resilient, high-performance services.
Does HAProxy support SSL/TLS bridging?
Yes, though our documentation calls it server-side TLS rather than bridging. HAProxy Enterprise load balancer terminates the client's TLS connection, then re-encrypts traffic to your servers using a certificate and private key, so traffic stays encrypted end to end.
Explore our SSL/TLS termination solution to see how HAProxy handles encryption at scale, or read our server-side TLS documentation for further implementation details.